Bug #75357 [Csd]: segfault loading WordPress wp-admin

From: Date: Sat, 14 Oct 2017 15:24:01 +0000
Subject: Bug #75357 [Csd]: segfault loading WordPress wp-admin
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-211684@lists.php.net to get a copy of this message
Edit report at https://bugs.php.net/bug.php?id=75357&edit=1

 ID:                 75357
 User updated by:    justin at serverpilot dot io
 Reported by:        justin at serverpilot dot io
 Summary:            segfault loading WordPress wp-admin
 Status:             Closed
 Type:               Bug
 Package:            opcache
 Operating System:   Ubuntu 16.04 x64
 PHP Version:        7.2.0RC3
 Block user comment: N
 Private report:     N

 New Comment:

I've emailed access info for a test box to you. Thanks!


Previous Comments:
------------------------------------------------------------------------
[2017-10-14 15:13:04] laruence@php.net

Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=abbdbc21b0f285f86ccd3ba01074fd5e9de2a26f
Log: Fixed bug #75357 (segfault loading WordPress wp-admin)

------------------------------------------------------------------------
[2017-10-14 00:46:27] laruence@php.net

please give an access to your box, you could send me via mail.  thanks

------------------------------------------------------------------------
[2017-10-13 15:49:26] justin at serverpilot dot io

Here's the rest of following the code until where it crashes.

In wp-includes/class-wp-query.php crashes at
$q['orderby'] = addslashes_gpc( $q['orderby'] );

Which is in wp-includes/formatting.php and crashes when calling:
return wp_slash($gpc);

Which is in the same file (wp-includes/formatting.php) and crashes at:
$value = addslashes( $value );

The var_dump of $value at that time is:

string(8) "modified"

The entire wp_slash() function is:

function wp_slash( $value ) {
	if ( is_array( $value ) ) {
		foreach ( $value as $k => $v ) {
			if ( is_array( $v ) ) {
				$value[$k] = wp_slash( $v );
			} else {
				$value[$k] = addslashes( $v );
			}
		}
	} else {
		$value = addslashes( $value );
	}
	return $value;
}

------------------------------------------------------------------------
[2017-10-12 16:08:11] justin at serverpilot dot io

I've only tested with the latest WordPress version (4.8.2).

It may be only /wp-admin/index.php that triggers the problem. If clicking around in wp-admin's
navigation to other pages besides /wp-admin/index.php and /wp-admin/index.php has not been requested
since FPM was restarted, the other wp-admin pages don't crash.

Trying to narrow down the code where the crash is happening, here is the chain of function calls
that, if any of them are not performed, the crash doesn’t happen.

In wp-admin/index.php crashes at:
<?php wp_dashboard(); ?>

Which is in wp-admin/includes/dashboard.php and crashes at:
<?php do_meta_boxes( $screen->id, 'side', '' ); ?>

Which is in wp-admin/includes/template.php and crashes at:
call_user_func($box['callback'], $object, $box);

This is the var_dump() output of $box['callback'] when it crashes:

string(24) "wp_dashboard_quick_press"

That function is in wp-admin/includes/dashboard.php and crashes at:
wp_dashboard_recent_drafts();

Which is in wp-admin/includes/dashboard.php and crashes at:
$drafts = get_posts( $query_args );

Which is in wp-includes/post.php and crashes at:
return $get_posts->query($r);

Which is in wp-includes/class-wp-query.php and crashes at:
return $this->get_posts();

I’m not sure where in WP_Query::get_posts() it’s crashing. Unfortunately I don’t have
time to dig into it right now.

I hope that helps.

------------------------------------------------------------------------
[2017-10-12 08:34:40] laruence@php.net

which version of wordpress are you using?

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=75357


--
Edit this bug report at https://bugs.php.net/bug.php?id=75357&edit=1


Thread (7 messages)

« previous php.bugs (#211684) next »